Should the reconciliation loop start to misbehave, we need a killswitch to get it to stop (e.g.) provisioning prebuilds.

#367 should hopefully catch everything, but shit happens.